#!/usr/bin/env bash
# SAFE DEFENSIVE VALIDATOR — SSH CONFIG HARDENING / EXPOSURE PROOF
#
# Purpose: Safely parses local sshd_config and ssh_config for weak settings
#          (PermitRootLogin, PasswordAuthentication, weak Ciphers/MACs, etc.)
#          using only grep/awk on the operator's own files. No remote access.
#
# Safety: Read-only. Bounded to common paths. Never starts sshd or connects.
#
# Generated by Vigil (Phase 1, template A — purely defensive).

set -euo pipefail

CONFIG_PATH=${1:-/etc/ssh/sshd_config}
STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ)

echo '{
  "validator": "ssh-config-validator",
  "schemaVersion": "1.0.0",
  "generatedBy": "Vigil safe-poc-generator (Phase 1, template A)",
  "startedAt": "'"$STARTED"'",
  "configPath": "'"$CONFIG_PATH"'",
  "findings": [],'

if [ -f "$CONFIG_PATH" ]; then
  echo '  "exists": true,'
  WEAKS=$(grep -E '^(PermitRootLogin|PasswordAuthentication|PermitEmptyPasswords|UsePAM|Protocol| Ciphers|MACs|KexAlgorithms)' "$CONFIG_PATH" 2>/dev/null | head -20 || true)
  echo '  "weakSettingsSample": "'$(echo "$WEAKS" | tr '\n' ';' | sed 's/"/\\"/g' | head -c 1500)'",'
else
  echo '  "exists": false,'
fi

echo '  "completedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "conclusion": "SSH config inspected locally. Review weakSettingsSample against CIS/ hardening benchmarks."
}'
exit 0